GDPR Privacy Policy & Data Controller Statement

1. Identification of the Data Controller

This privacy charter governs the data processing practices of the EHPS Behavioral Medicine & Preventive Health Archive (ehps2017.org), operated by:

European Health Psychology Research Consortium
Westersingel 94, 3015 LC Rotterdam, Netherlands
Email: [email protected] / [email protected]
Supervisory Authority: Autoriteit Persoonsgegevens (Dutch Data Protection Authority)

2. Core Data Protection Principles

The European Health Psychology Research Consortium adheres strictly to the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality as codified under Article 5 of the General Data Protection Regulation (GDPR).

As an independent academic research archive, we reject the pervasive commercialization of user attention. We do not monetize reader information, sell data to programmatic marketing networks, or participate in cross-site behavioral tracking syndicates.

3. Absolute Zero-Tracking and Zero-Ad Guarantee

Visitors to ehps2017.org benefit from a rigorous zero-surveillance architectural design:

• No Third-Party Advertising: We display no commercial advertisements, affiliate marketing widgets, or behavioral re-targeting pixels.
• No Commercial Analytics Trackers: We deploy no invasive analytics scripts such as Google Analytics, Meta Pixel, Hotjar, or similar commercial surveillance mechanisms.
• No Invasive Fingerprinting: Our infrastructure does not canvas-fingerprint, font-probe, or audio-context profile user devices.
• No Cookie Banners Necessary: Because we do not place non-essential, profiling, or tracking cookies on user devices, no consent banner is required under the ePrivacy Directive (Directive 2002/58/EC).

4. Client-Side Mathematical Calculator Architecture

Our interactive Behavioral Intervention Effect-Size (Cohen's d & NNT) Calculator located at ehps2017.org is constructed entirely in vanilla client-side JavaScript.

When researchers enter clinical trial parameters (group means, standard deviations, sample sizes, and control event rates), all computations execute locally within the user's browser runtime memory. No user-entered statistical numbers, patient cohort data, or clinical variables are ever transmitted across the network to our servers or stored in any database. The data remains strictly ephemeral within the local document object model.

5. Server Logs and Technical Telemetry

When you request documents from our web servers, minimal technical metadata is transiently processed under Article 6(1)(f) GDPR (legitimate interest in maintaining server network security and DDoS mitigation):

• Internet Protocol (IP) address (anonymized/truncated where feasible).
• Date, time, and timezone of the server request.
• Resource path requested (e.g., /how-to-protect-your-health-when-working-at-a-computer-all-day/).
• HTTP status code and byte size of transferred payload.
• User-agent string and referrer header transmitted by your browser.

These logs are maintained in isolated, access-restricted server files for a maximum retention period of 14 days solely for forensic threat detection and system stability. They are never joined with external identity profiles or retained in historical tracking databases.

6. Direct Correspondence and Submissions

If you contact the Consortium via email ([email protected] or [email protected]), your transmission details (name, email address, institutional affiliation, and message content) are processed under Article 6(1)(b) (performance of a contract or preliminary communication) and Article 6(1)(f) (legitimate academic interest in responding to scholar inquiries). We retain correspondence only for the duration necessary to resolve the inquiry or archive relevant editorial decisions.

7. Rights of Data Subjects Under European Law

Under Chapter III of the GDPR, all natural persons whose data is processed hold unambiguous legal rights:

• Right of Access (Article 15): Obtain confirmation as to whether personal data concerning you is processed and request a copy thereof.
• Right to Rectification (Article 16): Require the correction of inaccurate personal data.
• Right to Erasure / Right to be Forgotten (Article 17): Request deletion of your data when retention is no longer legally justified.
• Right to Restriction of Processing (Article 18): Restrict processing under specified legal conditions.
• Right to Data Portability (Article 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (Article 21): Object at any time to processing based on legitimate interests.

To exercise any statutory right, contact our Data Governance Officer at [email protected]. Inquiries are processed without undue delay and at latest within 30 days. You also retain the right to lodge a formal complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.